64a21d074850a4e8dd28a846e8f9e5d72d5549dc68d9ded2e9bff99f730f4d80

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 22:37

Target

file.exe
Size

471KB
MD5

810da00c69d55e89dca3bfe9a6f6a420
SHA1

ca02bdce48ac20f7b40ab720079009894f369990
SHA256

64a21d074850a4e8dd28a846e8f9e5d72d5549dc68d9ded2e9bff99f730f4d80
SHA512

453f25595db97195c6211a07c821977e1db5015906865fcbb535172c5fc1733a131eafc512dc896f4c8726c9d58cf2aa6b354d7e33ae3afd9371a0c5432b3034
SSDEEP

12288:Lh1Fk70Tnvjc52gSbBJKrk+bLcIW1SIoQT79Y4AyGItHYO2E89:Rk70Trcu2oqLISIoQT7C8pHFRQ

Score

7^/10

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/2816-0-0x00000000046D0000-0x0000000004732000-memory.dmp	net_reactor
behavioral1/memory/2816-3-0x00000000048C0000-0x0000000004900000-memory.dmp	net_reactor
behavioral1/memory/2816-4-0x0000000004730000-0x0000000004790000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 2816 WerFault.exe file.exe

pid	pid_target	process	target process
1684	2816	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

file.exe

description	pid	process	target process
PID 2816 wrote to memory of 1684	2816	file.exe	WerFault.exe
PID 2816 wrote to memory of 1684	2816	file.exe	WerFault.exe
PID 2816 wrote to memory of 1684	2816	file.exe	WerFault.exe
PID 2816 wrote to memory of 1684	2816	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 600
  2⤵
  - Program crash
  PID:1684

memory/2816-0-0x00000000046D0000-0x0000000004732000-memory.dmp

Filesize
392KB

Download
memory/2816-2-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download
memory/2816-1-0x0000000074B60000-0x000000007524E000-memory.dmp

Filesize
6.9MB

Download
memory/2816-3-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download
memory/2816-4-0x0000000004730000-0x0000000004790000-memory.dmp

Filesize
384KB

Download
memory/2816-7-0x0000000074B60000-0x000000007524E000-memory.dmp

Filesize
6.9MB

Download
memory/2816-8-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download
memory/2816-9-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download